465274 - (arithfuzz) Jesse's fuzzer for arithmetic correctness in tracemonkey

Status: RESOLVED WORKSFORME

(Core Graveyard :: Tracking, defect)

Description

[Jesse Ruderman]

This fuzzer makes sure the interpreter and JIT give the same results for when evaluating the same expressions.  It only tests a small subset of the expressions that jsfunfuzz tests, mostly in order to avoid side effects (which could make differing results legitimate).

Comment 1

[Brendan Eich [:brendan]]

Paranoid about shipping b2 without most if not all fixes -- provided the code is not just thrashing back and forth (and we had better be able to guarantee that or we should turn in our JS car keys).

/be

Comment 2

[Ryan VanderMeulen [:RyanVM]]

Jesse, are you still running this fuzzer on JM/IM?

Comment 3

[Jesse Ruderman]

No. Instead, I have combined bug 465479 with jsfunfuzz. Most scripts created by jsfunfuzz are now run through "./js", "./js -m", etc so the outputs can be compared.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jesse Ruderman from comment #3)
> No. Instead, I have combined bug 465479 with jsfunfuzz. Most scripts created
> by jsfunfuzz are now run through "./js", "./js -m", etc so the outputs can
> be compared.

Yep, bug 465479 & jsfunfuzz kind of takes care of this. WFM.